WRITTEN QUESTION E-0718/02 by Erik Meijer (GUE/NGL) to the Commission. Obligatory collection of information on users by Microsoft.NET Passport and measures to protect their privacy.
Date: 2002-03-15
Institutions: European Parliament, Provisional data
Subjects: application of EU law, data protection, database, disclosure of information, information technology industry, personal data, protection of privacy

C 205 E/200

Official Journal of the European Communities

EN

29.8.2002

supplement sickness insurance benefits in order to improve the state of health and the quality of life of
persons reliant on care. Under these circumstances, they must be regarded as ‘sickness benefits’ within the
meaning of Article 4(1)(a) of Regulation (EEC) No 1408/71 (see also Molenaar judgment, paragraphs 23-25,
and Jauch judgment (3), paragraph 28).

Since the care insurance benefits in question consist of direct payment or reimbursement of the costs
incurred as a result of the insured person’s reliance on care, they fall within the definition of the ‘benefits
in kind’ referred to in Articles 19(1)(a), 25(1)(a), and 28(1)(a) of Regulation No 1408/71 (see Molenaar
judgment, paragraph 32).

Article 18 of the said Regulation also applies to these benefits. According to paragraph 1 of this Article,
‘the competent institution of a Member State whose legislation makes the acquisition, retention or recovery
of the right to benefits conditional upon the completion of periods of insurance, employment or residence
shall, to the extent necessary, take account of periods of insurance, employment or residence completed
under the legislation of any other Member State as if they were periods completed under the legislation
which it administers’.

Consequently, the condition applicable to Community nationals, which was introduced into the legislation
in question by the Decree of 18 May 2001 referred to by the Honourable Members, requiring them to
have paid contributions for at least five years, must be applied in such a manner that periods of health
insurance completed under the legislation of another Member State are regarded as insurance periods
within the meaning of the legislation in question.

The Commission has contacted the Belgian authorities in order to verify the legislation in question’s
consistency with Community law and its application to Community nationals. It will keep the Honourable
Members informed of developments.

(1)
(2)
(3)

Judgment of 5 March 1998, Molenaar, C-160/96, ECR I-0843.
Judgment of 15 February 2000, Commission v French Republic, C-169/98, ECR I-1049.
Judgment of 8 March 2001, Jauch, C-215/99, ECR I-1901.

(2002/C 205 E/212)

WRITTEN QUESTION E-0718/02

by Erik Meijer (GUE/NGL) to the Commission

(15 March 2002)

Subject: Obligatory collection of information on users by Microsoft.NET Passport and measures to protect

their privacy

1.
Is the Commission aware of Microsoft’s free NET Passport service, which, while consumers are
engaged in a purchase, a game, a request or a bank transaction on line, is designed continually to collect
their personal
information via for instance, an e-mail address (Hotmail), a chat programme (MSN
Messenger), a shop (Expedia.com), an auction site (QXL), a community (MSN Communities) or a hotel
chain (Hilton.com) and that, as a result, a vast quantity of personal information is surreptitiously passed on
to unknown parties by, in particular, Hotmail address owners without their noticing it?

2.
Is the Commission also aware that failure to register with NET Passport results in exclusion from
many sites’ services, that unsubscribing is not possible, that periodically only out-of-date information is
removed and that the passwords to be given (minimum of six characters only) are easily accessible, to
some extent,
to others posing as system administrators or possessing considerable knowledge of
dictionaries?

3.
Does the Commission regard it as acceptable that users of public terminals in universities, libraries or
Internet cafes who fail to log off correctly may pass on their confidential information to the next user, that
to hire software via the Internet (using Microsoft servers instead of a personal hard disk) access is possible
only via NET Passport, and that, because of a de facto monopoly, Microsoft may shortly charge a high
price for what are still for the time being free services?

29.8.2002

EN

Official Journal of the European Communities

C 205 E/201

Is it lawful for a dominant firm to build up a very extensive database of personal information? Is NET
4.
Passport registered with national agencies supervising the application of privacy legislation? Is registration
mandatory in every Member State? Does such a requirement also apply where the database is not located
on the territory of an EU Member State?

Can national or European criminal investigators make use of the information collected without prior

5.
consent of the individuals concerned or the courts?

According to the Commission, is there any call for further regulation in order to make abuses by

6.
interested parties or subversion of current privacy rules impossible?

Answer given by Mr Bolkestein on behalf of the Commission

(7 May 2002)

1. to 3.
its alleged
The Commission is indeed aware of Microsoft’s NET Passport system and of
capabilities and shares some of the Honourable Member’s concerns. It is looking into this as a matter of
priority, in concertation with national data protection authorities, as regards the system’s compatibility (or
not) with EU data protection law.

A company operating in the Union is subject to Community law and may build up a database of
4.
personal information, provided the obligations laid down in Directive 95/46/EC of the Parliament and of
the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal
data and on the free movement of such data (1) are respected. These include having a specific, legitimate
purpose, informing the individual of identity of the controller of the data, of the purpose of collection and
the rights individual has, such as the right to access his/hers own personal data. In cases where consent for
processing is required, the Directive requires that it be unambiguous and freely given. The Directive also
lays down the obligation to notify such processing operations to national data protection authorities. But
the directive also provides for some exemptions from the notification obligation. The Commission is not at
present in a position to say whether this processing operation has been notified within the Community.

The question of whether and to what extent the Directive applies to a data base (or in the terms of the
Directive a data controller) located outside the Union, especially where data is collected directly from data
subjects via the Internet, is a complex one which the Commission and national data protection authorities
are at present examining carefully. Article 4.1(c) of the Directive provides for its application where a
controller makes use of equipment, automated or otherwise, situated on the territory of a Member State,
which means that the Directive does at least in some cases apply to controllers outside the Community.
Furthermore specific national rules concerning a third country in which the controller is established may
also apply and be enforceable within that jurisdiction. In this respect, Microsoft has notified the US
Department of Commerce that it adheres to a privacy policy that meets the Safe Harbor framework (2).

5.
On the basis of legislative measures, criminal investigators can make use of information collected
without the prior consent of the individuals concerned or the courts, provided that the rights of defence of
the individuals concerned are respected and that the restriction to the right to privacy is strictly necessary
for the purpose of the criminal
investigation. The information collected during the investigation may
moreover only be used to the extent necessary for those purposes.

6.
In accordance with Article 33 of the Directive, the Commission is examining the application of
Directive 95/46/EC and expects to make a report before the end of the year. The subversion of current
rules will be looked into in that context.

(1) OJ L 281, 23.11.1995.
(2) See Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46/EC of the Parliament and of
the Council on the adequacy of the protection provided by the Safe Harbor privacy principles and related frequently
asked questions issued by the US Department of Commerce, OJ L 215, 25.8.2000.